Staff can successfully create an import queue when they don't have the CREATE_BIB_IMPORT_QUEUE permission

Bug #1325637 reported by Kathy Lussier
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Evergreen
Confirmed
Low
Unassigned

Bug Description

Evergreen version: 2.4+

Using a staff account that does not have the CREATE_BIB_IMPORT_QUEUE permission, if you upload records using the acquisitions Load MARC Order Records interface, staff will be able to successfully create an import queue and load records into the queue.

During the upload, the progress bar will keep displaying and the user will never see their links to the PO, selection list, or queue. but all other aspects of the upload proceed as if the user has the necessary permissions.

My expectation is that a user without this permission would not be able to create the import queue.

Revision history for this message
Andrea Neiman (aneiman) wrote :

2.12-beta: I cannot create an upload queue using an account without the CREATE_BIB_IMPORT_QUEUE permission. In MARC Batch Import/Export, I get the expected user permission error; in Load MARC Order Records, I don't get the error message but clicking "Upload" doesn't do anything either.

Revision history for this message
Kathy Lussier (klussier) wrote :

Thanks for looking into this Andrea! I'll give this one a try in a bit to see if I can still replicate it.

Revision history for this message
Chris Sharp (chrissharp123) wrote :

Marking incomplete since it sounds like the problem may no longer be happening.

Changed in evergreen:
status: New → Incomplete
Revision history for this message
Kathy Lussier (klussier) wrote :

I'm moving this one back to triage. I just testing it again and am still able to create an Import Queue with an account where that permission is not available.

It only occurs in the Load MARC Order Records Interface. The behavior I described in paragraph 2 does NOT occur (there must have been some other missing permission in play), but I am able to successfully import records and create a queue.
To replicate,
- using the concerto data, remove the CREATE_BIB_IMPORT_QUEUE permission from the Acquisitions group.
- Log in as a user belonging to the Acquisitions group - I used br1breid
- Go to the MARC Order Records Interface. Select 'Create Purchase Order', Select a Provider, Select a Context OU, Select a Fiscal Year. Type a name for the bib queue and ensure 'import non-matching records' and 'merge on best match' are selected.
- Choose a file with valid MARC records to upload. Click the upload button

The upload will proceed and the links to View Purchase Order and View Import Queue will display. If you try to view the import queue, you will be stopped because you don't have the CREATE_BIB_IMPORT_QUEUE permission.

Looking in the database, the queue is created, but the complete field is set to False. If you log in with an account that has permission to view the queue, it will not show up in the list of acquisitions queues available from the MARC batch import interface. However, if you go to the PO and click on the link to the queue, you will be able to retrieve it.

Screencast is available at https://drive.google.com/file/d/0B74gDMUDwDXqNU1IbG5oaG5DbkU/view

Changed in evergreen:
status: Incomplete → Triaged
Revision history for this message
Andrea Neiman (aneiman) wrote :

I checked on this using Kathy's steps outlined in comment #4 above.

Tested in web client running 3.0.0. I tested separately in Chrome & Firefox with the same results.

After I clicked "Upload", the lower part of the Load MARC Order Records interface updated to read as follows:

Lineitems Processed 10
Vandelay Records Processed 10
Bib Records Merged/Imported 0
ACQ Copies Processed 0
Debits Encumbered 0
Real Copies Processed 0
Upload Complete!

When I clicked the View Import Queue link, a new window opened at the URL https://webby.evergreencatalog.com/eg/staff/cat/catalog/vandelay?qtype=bib&qid=4 and I got the error "event:5000:perm_failure -> Permission Denied CREATE_BIB_IMPORT_QUEUE@4".

When I clicked through the error, the window just hung with the dojo progress bar running.

When I clicked on the View Purchase Order link, a new window opened at the URL https://webby.evergreencatalog.com/eg/staff/acq/legacy/po/view/4 and I was able to view my imported titles in the PO. I was also able to retrieve the PO via Acq Search.

I did not any of my imported titles in a catalog search, though; and I don't have the ability to check the database to look at the Complete field.

I did not see the queues I created when I looked in MARC Batch Import/Export -> Inspect Queue -> Acquisitions.

So I'm marking this as confirmed.

Changed in evergreen:
status: Triaged → Confirmed
tags: added: acq-loadmarc
Elaine Hardy (ehardy)
tags: added: permissions
removed: vandelay
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.